Static task
static1
Behavioral task
behavioral1
Sample
43bf3945d23f6219bf673677c5a3ebf0_exe32.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
43bf3945d23f6219bf673677c5a3ebf0_exe32.exe
Resource
win10v2004-20230915-en
General
-
Target
43bf3945d23f6219bf673677c5a3ebf0_exe32.exe
-
Size
11KB
-
MD5
43bf3945d23f6219bf673677c5a3ebf0
-
SHA1
186611c2ac7b15ac9e680a81d0b0ec78d7ea24b8
-
SHA256
b41c1e2f542fcad6a46f86b9bbd533c6472bf8abd3191ce7113b13a20f4bc1da
-
SHA512
b102fa82d525d690845ba1db3c69bbea176496ca09d29fffc82e319f06e66dc3d00349387ba82c0d1b837ab0cbe7656626db5bc2b6bef5725b2c66419e0f379f
-
SSDEEP
192:tzwBMDhjVec0FC5CbzRIqIoh8MenM1hXPZFJJ9Oqs5e34l:tbDtEdFCE+oteM1hXPZFhp36
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 43bf3945d23f6219bf673677c5a3ebf0_exe32.exe
Files
-
43bf3945d23f6219bf673677c5a3ebf0_exe32.exe.exe windows:5 windows x86
441bcc434b17d7f1db56ca9923d283ab
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitProcess
GetCommandLineW
HeapAlloc
GetQueuedCompletionStatus
HeapFree
ReadDirectoryChangesW
GetProcessHeap
WriteFile
OpenProcess
WideCharToMultiByte
FormatMessageW
GetExitCodeProcess
CreateFileW
GetLastError
GetLongPathNameW
CreateIoCompletionPort
CloseHandle
LocalFree
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoW
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime
user32
wsprintfW
shell32
CommandLineToArgvW
msvcr90
ferror
_wrename
wcscat_s
wcscpy_s
fclose
_amsg_exit
_wcserror_s
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_crt_debugger_hook
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
memset
wcslen
fgetws
_errno
strlen
_wcsnicmp
_wtoi
fwprintf
_wfopen_s
__wgetmainargs
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ